[Feature Request] Updating Air-Gapped Secure Appliance

[BigM]

Hello,

I'm unsure if this is the best place to post this request, so please let me know if there is a better place.

I am in the process of setting up VEEAM in a complex air-gapped network. We expect to have 5 VSA appliances deployed within 5 distinct networks. The network perimeter is very controlled and there is essentially no external communication to the wider world and extremely limited communications between environment (not enough to share a VEEAM Mirror).

As I understand it, there are currently 2 supported methods for updating a VSA without internet:
- Run a mirror of the Veeam repository
- Redeploy the VSA and restore configuration

Is there plans in the future to allow patches to be manually uploaded using the "Upload a HotFix" function of the VSA?

The primary reason behind us choosing to use the appliance was the reduced infrastructure footprint and the all-in-one nature of the VSA. For us to run a mirror we would require additional infrastructure to be configured, additional skilling of staff and additional support requirements. This removes the benefit of the VSA to our deployments.

The alternative of redeploying the VSA for every update is a time-consuming process which, while doable, is more arduous and error prone than simply updating live. Given we would need to repeat this process for each VSA, the time adds up quick.

Ideally there would be a way to download the bundle patch files and patch live using those files, without the need for any additional infrastructure.

Thanks in advance,
Mitch

[david.domask]

Hi Mitch,

Right now nothing to share regarding the manual patching but we can consider it.

May I ask with regards to a local mirror, if there was a Veeam-supported mirror server you could deploy from a VSA (just as an example) and all you had to do was choose how to do the mirroring, would that be more feasible for you and your team?

[BigM]

Thanks David,

The biggest challenge we face is the lack of connectivity into the environment. Basically, every file that goes into our environments is downloaded manually from a vendor and then re-uploaded, so we essentially proxy files manually.

If there were a mechanism to manually upload files to the mirror (and the mirror was a simple piece to setup/deploy), that would work in our situation. Getting files where they need to be in a consumable format is the sticking point unfortunately.

Mitch

[alen88]

Hi Mitch,

Right now nothing to share regarding the manual patching but we can consider it.

May I ask with regards to a local mirror, if there was a Veeam-supported mirror server you could deploy from a VSA (just as an example) and all you had to do was choose how to do the mirroring, would that be more feasible for you and your team?

This would be a great feature, especially if we could add patches manually to an already deployed internal mirror server. I am currently in the same situation as the OP, and I would do everything possible to avoid reinstalling multiple VSAs and restoring their configurations.
But im also fine with "manually" patching VSA with .bndl like file, if you would provide it. Everything but reinstalling VSAs every time.